Skip to content

deps: bump the go-minor-patch group across 1 directory with 8 updates - #1079

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-patch-190b7ca982
Open

deps: bump the go-minor-patch group across 1 directory with 8 updates#1079
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-patch-190b7ca982

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-minor-patch group with 8 updates in the / directory:

Package From To
github.com/aws/aws-sdk-go-v2/config 1.33.5 1.33.7
github.com/aws/aws-sdk-go-v2/service/sesv2 1.73.0 1.78.0
github.com/aws/aws-sdk-go-v2/service/sts 1.51.0 1.51.2
github.com/aws/smithy-go 1.28.1 1.28.4
github.com/gowebpki/jcs 1.0.1 1.0.2
github.com/riverqueue/river 0.47.0 0.49.0
github.com/riverqueue/river/riverdriver/riverpgxv5 0.47.0 0.49.0
github.com/riverqueue/river/rivertype 0.47.0 0.49.0

Updates github.com/aws/aws-sdk-go-v2/config from 1.33.5 to 1.33.7

Commits

Updates github.com/aws/aws-sdk-go-v2/service/sesv2 from 1.73.0 to 1.78.0

Commits

Updates github.com/aws/aws-sdk-go-v2/service/sts from 1.51.0 to 1.51.2

Commits

Updates github.com/aws/smithy-go from 1.28.1 to 1.28.4

Changelog

Sourced from github.com/aws/smithy-go's changelog.

Release (2026-10-09)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.28.5
    • Bug Fix: Retain the key with the zero value when encountering a null-value key in a dense map. This matches how legacy code-generated JSON deserializers behaved.

Release (2026-10-07)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.28.4
    • Bug Fix: Revert #698 that fixed JoinPath with trailing slash. This has a side effect on certain S3 API paths in the downstream SDK that need more consideration.

Release (2026-10-06)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.28.3
    • Bug Fix: Accept either casing of message/Message on modeled JSON error structures in schema-based deserialization, and emit the smithy.api#error trait in generated schemas
    • Bug Fix: Include the underlying error when logging failures to discard or close an HTTP response body

Release (2026-09-18)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.28.2
    • Bug Fix: Avoid allocating a slice in ValidateEndpointHost by indexing into the hostname instead of using strings.Split.
    • Bug Fix: Fix event stream decode panic on unknown header value type.
    • Bug Fix: Fix schema-serde CBOR decode panic on malformed string/blob length.
    • Bug Fix: JoinPath keeps a trailing slash when the added path is a slash.

Release (2026-08-26)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.28.1
    • Bug Fix: Fix broken AddLogger middleware since its insert point was removed.

Release (2026-08-25.2)

... (truncated)

Commits

Updates github.com/gowebpki/jcs from 1.0.1 to 1.0.2

Release notes

Sourced from github.com/gowebpki/jcs's releases.

Version 1.0.2

A fully implemented version of RFC 8785 for Golang with fixes for various bugs.

Commits

Updates github.com/riverqueue/river from 0.47.0 to 0.49.0

Release notes

Sourced from github.com/riverqueue/river's releases.

v0.49.0

⚠️ If using River Pro, make sure to upgrade it to at least River Pro v0.32.0 to get a compatible package.

Changed

  • Internal transaction helpers now reuse existing transactions instead of creating unnecessary savepoints. Callers of transactional APIs must roll back their transaction on error; applications that need partial rollback can create an explicit savepoint around the River call. Set RIVER_USE_LEGACY_SUBTRANSACTIONS=1 (or true) before starting the application to restore savepoints in these helpers, including those used by River Pro. This is a temporary compatibility fallback planned for removal in a future release. [PR #1420](riverqueue/river#1420).

Fixed

  • Fixed rivertest.Worker to honor a configured Config.JobStuckThreshold for stuck job detection. Previously, it always used an internal 5 second threshold, so the Job appears to be stuck log line was emitted at a different time than it would be under a real client. [PR #1418](riverqueue/river#1418).
  • Fixed SQLite job cleanup stalling when excluded queues fill the oldest batch, and added support for included queue filters so per-queue retention works on SQLite. [PR #1417](riverqueue/river#1417).
  • Fixed a unique insert skipped as a duplicate of a job of a different kind (possible with UniqueOpts.ExcludeKind) changing the existing job's kind to its own. [PR #1421](riverqueue/river#1421).

v0.48.0

⚠️ This release contains a new database migration, version 8, but it only affects SQLite:

  • If you're on Postgres, you can ignore it with no adverse effect.
  • If you're on SQLite, it rebuilds river_job to add an AUTOINCREMENT keyword to the primary key, preventing a possible edge case where generated job IDs could be reused after deletion. It's not necessary to run the migration for River to work, but it's a good idea to get it in when convenient. [PR #1390](riverqueue/river#1390).

Added

  • Added support for YugabyteDB. When LISTEN/NOTIFY is unavailable or disabled, clients automatically poll for running job cancellations and queue pause, resume, and metadata changes, and skip unsupported notification broadcasts. This works with the default PollOnly: false. Native notifications require YugabyteDB 2025.2.3 or later with ysql_yb_enable_listen_notify=true on both Masters and TServers. [PR #1347](riverqueue/river#1347).
  • Added Config.LeaderElectionDisabled to let a client work jobs without participating in leader election or running maintenance services. Other eligible clients in the same database and schema continue handling scheduling, retries, periodic enqueueing, rescue, and cleanup. [PR #1382](riverqueue/river#1382).
  • Added Config.FetchOnlyKnownKinds to restrict job fetching to registered worker kinds, including aliases. Clients with different workers can share a queue while leaving unknown jobs available without consuming attempts. Disabled by default; leader election and stuck-job rescue behavior are unchanged. [PR #1396](riverqueue/river#1396).

Changed

  • UniqueOpts.ByPeriod now derives a job's period from its effective scheduled time (InsertOpts.ScheduledAt when set, otherwise the insertion time), so scheduled jobs are deduplicated against other jobs scheduled in the same period rather than against jobs inserted in the same period. Periods are also now always measured in UTC, so processes and ScheduledAt values in different time zones produce the same unique key for the same period. Unique keys for scheduled ByPeriod jobs, and for any ByPeriod job inserted from a process whose local time zone isn't UTC, differ from those produced by previous versions. During a rolling upgrade, old and new clients may therefore each insert one job for such a period; jobs that aren't scheduled and are inserted from UTC processes are unaffected. [PR #1377](riverqueue/river#1377).
  • UniqueOpts{ExcludeKind: true} alone is now rejected at insert time instead of being silently ignored. UniqueOpts.isEmpty() now considers ExcludeKind, in line with the equivalent handling in internal/dbunique. Warning: This new rejection can be considered a minor breaking change. [PR #1404](riverqueue/river#1404).

Fixed

  • Fixed cancelled transaction starts leaving Turso connections unusable, which could prevent maintenance from recovering after a startup failure. [PR #1347](riverqueue/river#1347).
  • Fixed maintenance startup failures leaving a client renewing leadership with maintenance stopped in poll-only mode. After exhausting startup retries, clients now request local resignation without depending on database notifications. [PR #1347](riverqueue/river#1347).
  • Fixed JobRescuer overwriting jobs that complete, leave the running state, or are claimed again by another worker after being fetched for rescue, preserving their state, errors, metadata, and timestamps across PostgreSQL and SQLite drivers. Fixes #1302. [PR #1373](riverqueue/river#1373).
  • Fixed SQLite job list pagination skipping or repeating jobs by formatting cursor timestamps consistently with stored timestamps. [PR #1374](riverqueue/river#1374).
  • Improved PostgreSQL job listing performance when filtering by one finalized state (completed, cancelled, or discarded) and sorting by finalized time, including in River UI. [PR #1374](riverqueue/river#1374).
  • Fixed rivermigrate leaving river_migration rows behind after migrating a non-main migration line down through its version 1, which caused a later up migration of that line to skip version 1. With MigrateTx, rows for every removed version were left behind. [PR #1378](riverqueue/river#1378).
  • Fixed river bench inserting every benchmark job with a num arg of 0 instead of numbering jobs sequentially. [PR #1379](riverqueue/river#1379).
  • Attempt errors that are valid JSON but don't have the shape River writes (for example an at timestamp in another format, an attempt stored as a string, or an error or trace that isn't a string) are now decoded on a best effort basis when reading jobs from the database. Timestamps outside RFC 3339 are left zero; stored values are unchanged. Previously a single such element made its job unreadable, and if that happened while fetching jobs, every job locked in the same fetch was left running indefinitely. [PR #1380](riverqueue/river#1380).
  • A fetched job whose row can't be decoded (for example a SQLite job whose tags were changed to something other than an array of strings) no longer leaves every job locked in the same fetch stuck running. The other jobs are worked normally, while the undecodable job's attempt fails with an error describing the decode failure, and it's retried or discarded like any other failed job. Its original values are preserved, with non-array errors values wrapped to append the failure or rescue error. Neither the rescuer nor the SQLite scheduler fails on such a job, so its retry doesn't stop other jobs from being rescued or scheduled. [PR #1380](riverqueue/river#1380).
  • Fixed SQLite notification listeners delivering notifications from before a subscription or from an unsubscribe gap. Notification reads now fetch subscribed topics in bounded batches, and cleanup deletes expired notifications in batches of 10,000 rows (reduced to 1,000 after repeated timeouts), with pauses between batches to reduce write lock contention. [PR #1381](riverqueue/river#1381).
  • Fixed the job completer panicking when a job it was finalizing had its state changed concurrently, like being moved to pending out of band, or being rescued while the completer's update waited on the row lock (in which case PostgreSQL returns the job's pre-update running row). Such jobs are now skipped without emitting a completion event. [PR #1383](riverqueue/river#1383).
  • Fixed JobList pagination skipping or repeating jobs when ordering by JobListOrderByTime with multiple states. Cursors now use the same time field as the list's ordering (the one for the first listed state) rather than the one for each job's own state. Jobs where that field is null, like finalized_at for unfinalized jobs, are paginated correctly and consistently sort last in ascending order and first in descending order on all drivers. Ordering by JobListOrderByTime with an empty States() filter now uses scheduled_at instead of returning an error. [PR #1384](riverqueue/river#1384).
  • A SQLite job whose args, attempted_by, errors, metadata, or tags were changed to text that isn't valid JSON no longer makes every fetch from its queue fail with a "malformed JSON" error. The job's attempt fails like that of any other job that can't be decoded, and completing, rescuing, or scheduling it no longer fails either. Invalid values are left in place, except that an invalid errors value is kept as a string in a new array so that attempt errors can still be appended. [PR #1386](riverqueue/river#1386).
  • Fixed UniqueOpts.ByArgs skipping distinct jobs or failing inserts when JSON keys contain path syntax (like user.id), are empty, or come from unnamed tags like json:",omitempty". Unaffected unique keys remain unchanged; affected jobs may be inserted again after upgrading or by old and new clients during a rolling upgrade. [PR #1387](riverqueue/river#1387).
  • Fixed JobListCursor.UnmarshalText rejecting valid cursors whose URL-safe base64 encoding contains - or _, so cursors produced by MarshalText always round-trip. [PR #1388](riverqueue/river#1388).
  • Fixed SQLite drivers deleting jobs in a finalized state whose retention period was set to -1 (keep forever), like Config.DiscardedJobRetentionPeriod: -1, whenever another state's retention period was finite. [PR #1389](riverqueue/river#1389).
  • Fixed SQLite reusing the ID of a deleted job when that job held the largest ID, which could cause an ID observed earlier to refer to an unrelated job later. [PR #1390](riverqueue/river#1390).
  • Fixed the Job appears to be stuck log line reporting the client-level JobTimeout instead of the worker-level timeout when a worker overrides Timeout. [PR #1394](riverqueue/river#1394).

... (truncated)

Changelog

Sourced from github.com/riverqueue/river's changelog.

[0.49.0] - 2026-10-05

⚠️ If using River Pro, make sure to upgrade it to at least River Pro v0.32.0 to get a compatible package.

Changed

  • Internal transaction helpers now reuse existing transactions instead of creating unnecessary savepoints. Callers of transactional APIs must roll back their transaction on error; applications that need partial rollback can create an explicit savepoint around the River call. Set RIVER_USE_LEGACY_SUBTRANSACTIONS=1 (or true) before starting the application to restore savepoints in these helpers, including those used by River Pro. This is a temporary compatibility fallback planned for removal in a future release. [PR #1420](riverqueue/river#1420).

Fixed

  • Fixed rivertest.Worker to honor a configured Config.JobStuckThreshold for stuck job detection. Previously, it always used an internal 5 second threshold, so the Job appears to be stuck log line was emitted at a different time than it would be under a real client. [PR #1418](riverqueue/river#1418).
  • Fixed SQLite job cleanup stalling when excluded queues fill the oldest batch, and added support for included queue filters so per-queue retention works on SQLite. [PR #1417](riverqueue/river#1417).
  • Fixed a unique insert skipped as a duplicate of a job of a different kind (possible with UniqueOpts.ExcludeKind) changing the existing job's kind to its own. [PR #1421](riverqueue/river#1421).

[0.48.0] - 2026-09-30

⚠️ This release contains a new database migration, version 8, but it only affects SQLite:

  • If you're on Postgres, you can ignore it with no adverse effect.
  • If you're on SQLite, it rebuilds river_job to add an AUTOINCREMENT keyword to the primary key, preventing a possible edge case where generated job IDs could be reused after deletion. It's not necessary to run the migration for River to work, but it's a good idea to get it in when convenient. [PR #1390](riverqueue/river#1390).

⚠️ If using River Pro, make sure to upgrade it to at least River Pro v0.31.0 to get a compatible package.

Added

  • Added support for YugabyteDB. When LISTEN/NOTIFY is unavailable or disabled, clients automatically poll for running job cancellations and queue pause, resume, and metadata changes, and skip unsupported notification broadcasts. This works with the default PollOnly: false. Native notifications require YugabyteDB 2025.2.3 or later with ysql_yb_enable_listen_notify=true on both Masters and TServers. [PR #1347](riverqueue/river#1347).
  • Added Config.LeaderElectionDisabled to let a client work jobs without participating in leader election or running maintenance services. Other eligible clients in the same database and schema continue handling scheduling, retries, periodic enqueueing, rescue, and cleanup. [PR #1382](riverqueue/river#1382).
  • Added Config.FetchOnlyKnownKinds to restrict job fetching to registered worker kinds, including aliases. Clients with different workers can share a queue while leaving unknown jobs available without consuming attempts. Disabled by default; leader election and stuck-job rescue behavior are unchanged. [PR #1396](riverqueue/river#1396).

Changed

  • UniqueOpts.ByPeriod now derives a job's period from its effective scheduled time (InsertOpts.ScheduledAt when set, otherwise the insertion time), so scheduled jobs are deduplicated against other jobs scheduled in the same period rather than against jobs inserted in the same period. Periods are also now always measured in UTC, so processes and ScheduledAt values in different time zones produce the same unique key for the same period. Unique keys for scheduled ByPeriod jobs, and for any ByPeriod job inserted from a process whose local time zone isn't UTC, differ from those produced by previous versions. During a rolling upgrade, old and new clients may therefore each insert one job for such a period; jobs that aren't scheduled and are inserted from UTC processes are unaffected. [PR #1377](riverqueue/river#1377).
  • UniqueOpts{ExcludeKind: true} alone is now rejected at insert time instead of being silently ignored. UniqueOpts.isEmpty() now considers ExcludeKind, in line with the equivalent handling in internal/dbunique. Warning: This new rejection can be considered a minor breaking change. [PR #1404](riverqueue/river#1404).

Fixed

  • Fixed cancelled transaction starts leaving Turso connections unusable, which could prevent maintenance from recovering after a startup failure. [PR #1347](riverqueue/river#1347).
  • Fixed maintenance startup failures leaving a client renewing leadership with maintenance stopped in poll-only mode. After exhausting startup retries, clients now request local resignation without depending on database notifications. [PR #1347](riverqueue/river#1347).
  • Fixed JobRescuer overwriting jobs that complete, leave the running state, or are claimed again by another worker after being fetched for rescue, preserving their state, errors, metadata, and timestamps across Postgres and SQLite drivers. Fixes #1302. [PR #1373](riverqueue/river#1373).
  • Fixed SQLite job list pagination skipping or repeating jobs by formatting cursor timestamps consistently with stored timestamps. [PR #1374](riverqueue/river#1374).
  • Improved Postgres job listing performance when filtering by one finalized state (completed, cancelled, or discarded) and sorting by finalized time, including in River UI. [PR #1374](riverqueue/river#1374).
  • Fixed rivermigrate leaving river_migration rows behind after migrating a non-main migration line down through its version 1, which caused a later up migration of that line to skip version 1. With MigrateTx, rows for every removed version were left behind. [PR #1378](riverqueue/river#1378).
  • Fixed river bench inserting every benchmark job with a num arg of 0 instead of numbering jobs sequentially. [PR #1379](riverqueue/river#1379).
  • Attempt errors that are valid JSON but don't have the shape River writes (for example an at timestamp in another format, an attempt stored as a string, or an error or trace that isn't a string) are now decoded on a best effort basis when reading jobs from the database. Timestamps outside RFC 3339 are left zero; stored values are unchanged. Previously a single such element made its job unreadable, and if that happened while fetching jobs, every job locked in the same fetch was left running indefinitely. [PR #1380](riverqueue/river#1380).
  • A fetched job whose row can't be decoded (for example a SQLite job whose tags were changed to something other than an array of strings) no longer leaves every job locked in the same fetch stuck running. The other jobs are worked normally, while the undecodable job's attempt fails with an error describing the decode failure, and it's retried or discarded like any other failed job. Its original values are preserved, with non-array errors values wrapped to append the failure or rescue error. Neither the rescuer nor the SQLite scheduler fails on such a job, so its retry doesn't stop other jobs from being rescued or scheduled. [PR #1380](riverqueue/river#1380).
  • Fixed SQLite notification listeners delivering notifications from before a subscription or from an unsubscribe gap. Notification reads now fetch subscribed topics in bounded batches, and cleanup deletes expired notifications in batches of 10,000 rows (reduced to 1,000 after repeated timeouts), with pauses between batches to reduce write lock contention. [PR #1381](riverqueue/river#1381).
  • Fixed the job completer panicking when a job it was finalizing had its state changed concurrently, like being moved to pending out of band, or being rescued while the completer's update waited on the row lock (in which case Postgres returns the job's pre-update running row). Such jobs are now skipped without emitting a completion event. [PR #1383](riverqueue/river#1383).
  • Fixed JobList pagination skipping or repeating jobs when ordering by JobListOrderByTime with multiple states. Cursors now use the same time field as the list's ordering (the one for the first listed state) rather than the one for each job's own state. Jobs where that field is null, like finalized_at for unfinalized jobs, are paginated correctly and consistently sort last in ascending order and first in descending order on all drivers. Ordering by JobListOrderByTime with an empty States() filter now uses scheduled_at instead of returning an error. [PR #1384](riverqueue/river#1384).
  • A SQLite job whose args, attempted_by, errors, metadata, or tags were changed to text that isn't valid JSON no longer makes every fetch from its queue fail with a "malformed JSON" error. The job's attempt fails like that of any other job that can't be decoded, and completing, rescuing, or scheduling it no longer fails either. Invalid values are left in place, except that an invalid errors value is kept as a string in a new array so that attempt errors can still be appended. [PR #1386](riverqueue/river#1386).
  • Fixed UniqueOpts.ByArgs skipping distinct jobs or failing inserts when JSON keys contain path syntax (like user.id), are empty, or come from unnamed tags like json:",omitempty". Unaffected unique keys remain unchanged; affected jobs may be inserted again after upgrading or by old and new clients during a rolling upgrade. [PR #1387](riverqueue/river#1387).

... (truncated)

Commits
  • da5a26e Prepare v0.49.0 release changelog (#1439)
  • 9af6018 Prepare release v0.49.0 (#1438)
  • 23a3805 require a transaction for pilot insertion (#1431)
  • 147c425 Bump the go-dependencies group across 1 directory with 3 updates (#1437)
  • 6411224 Run only latest Postgres + SQLite job with -race (#1429)
  • 6cdaf38 Avoid opening subtransactions when already in a transaction (#1420)
  • ddb6c4d Don't run SQLite/Turso tests as part of every Postgres job (#1425)
  • cf809b4 Fix unique skip rewriting the existing job's kind under ExcludeKind (#1421)
  • fed8f33 fix SQLite job cleanup queue filtering (#1417)
  • 5d73cf1 Small test tweak to get failures in CI (#1419)
  • Additional commits viewable in compare view

Updates github.com/riverqueue/river/riverdriver/riverpgxv5 from 0.47.0 to 0.49.0

Release notes

Sourced from github.com/riverqueue/river/riverdriver/riverpgxv5's releases.

v0.49.0

⚠️ If using River Pro, make sure to upgrade it to at least River Pro v0.32.0 to get a compatible package.

Changed

  • Internal transaction helpers now reuse existing transactions instead of creating unnecessary savepoints. Callers of transactional APIs must roll back their transaction on error; applications that need partial rollback can create an explicit savepoint around the River call. Set RIVER_USE_LEGACY_SUBTRANSACTIONS=1 (or true) before starting the application to restore savepoints in these helpers, including those used by River Pro. This is a temporary compatibility fallback planned for removal in a future release. [PR #1420](riverqueue/river#1420).

Fixed

  • Fixed rivertest.Worker to honor a configured Config.JobStuckThreshold for stuck job detection. Previously, it always used an internal 5 second threshold, so the Job appears to be stuck log line was emitted at a different time than it would be under a real client. [PR #1418](riverqueue/river#1418).
  • Fixed SQLite job cleanup stalling when excluded queues fill the oldest batch, and added support for included queue filters so per-queue retention works on SQLite. [PR #1417](riverqueue/river#1417).
  • Fixed a unique insert skipped as a duplicate of a job of a different kind (possible with UniqueOpts.ExcludeKind) changing the existing job's kind to its own. [PR #1421](riverqueue/river#1421).

v0.48.0

⚠️ This release contains a new database migration, version 8, but it only affects SQLite:

  • If you're on Postgres, you can ignore it with no adverse effect.
  • If you're on SQLite, it rebuilds river_job to add an AUTOINCREMENT keyword to the primary key, preventing a possible edge case where generated job IDs could be reused after deletion. It's not necessary to run the migration for River to work, but it's a good idea to get it in when convenient. [PR #1390](riverqueue/river#1390).

Added

  • Added support for YugabyteDB. When LISTEN/NOTIFY is unavailable or disabled, clients automatically poll for running job cancellations and queue pause, resume, and metadata changes, and skip unsupported notification broadcasts. This works with the default PollOnly: false. Native notifications require YugabyteDB 2025.2.3 or later with ysql_yb_enable_listen_notify=true on both Masters and TServers. [PR #1347](riverqueue/river#1347).
  • Added Config.LeaderElectionDisabled to let a client work jobs without participating in leader election or running maintenance services. Other eligible clients in the same database and schema continue handling scheduling, retries, periodic enqueueing, rescue, and cleanup. [PR #1382](riverqueue/river#1382).
  • Added Config.FetchOnlyKnownKinds to restrict job fetching to registered worker kinds, including aliases. Clients with different workers can share a queue while leaving unknown jobs available without consuming attempts. Disabled by default; leader election and stuck-job rescue behavior are unchanged. [PR #1396](riverqueue/river#1396).

Changed

  • UniqueOpts.ByPeriod now derives a job's period from its effective scheduled time (InsertOpts.ScheduledAt when set, otherwise the insertion time), so scheduled jobs are deduplicated against other jobs scheduled in the same period rather than against jobs inserted in the same period. Periods are also now always measured in UTC, so processes and ScheduledAt values in different time zones produce the same unique key for the same period. Unique keys for scheduled ByPeriod jobs, and for any ByPeriod job inserted from a process whose local time zone isn't UTC, differ from those produced by previous versions. During a rolling upgrade, old and new clients may therefore each insert one job for such a period; jobs that aren't scheduled and are inserted from UTC processes are unaffected. [PR #1377](riverqueue/river#1377).
  • UniqueOpts{ExcludeKind: true} alone is now rejected at insert time instead of being silently ignored. UniqueOpts.isEmpty() now considers ExcludeKind, in line with the equivalent handling in internal/dbunique. Warning: This new rejection can be considered a minor breaking change. [PR #1404](riverqueue/river#1404).

Fixed

  • Fixed cancelled transaction starts leaving Turso connections unusable, which could prevent maintenance from recovering after a startup failure. [PR #1347](riverqueue/river#1347).
  • Fixed maintenance startup failures leaving a client renewing leadership with maintenance stopped in poll-only mode. After exhausting startup retries, clients now request local resignation without depending on database notifications. [PR #1347](riverqueue/river#1347).
  • Fixed JobRescuer overwriting jobs that complete, leave the running state, or are claimed again by another worker after being fetched for rescue, preserving their state, errors, metadata, and timestamps across PostgreSQL and SQLite drivers. Fixes #1302. [PR #1373](riverqueue/river#1373).
  • Fixed SQLite job list pagination skipping or repeating jobs by formatting cursor timestamps consistently with stored timestamps. [PR #1374](riverqueue/river#1374).
  • Improved PostgreSQL job listing performance when filtering by one finalized state (completed, cancelled, or discarded) and sorting by finalized time, including in River UI. [PR #1374](riverqueue/river#1374).
  • Fixed rivermigrate leaving river_migration rows behind after migrating a non-main migration line down through its version 1, which caused a later up migration of that line to skip version 1. With MigrateTx, rows for every removed version were left behind. [PR #1378](riverqueue/river#1378).
  • Fixed river bench inserting every benchmark job with a num arg of 0 instead of numbering jobs sequentially. [PR #1379](riverqueue/river#1379).
  • Attempt errors that are valid JSON but don't have the shape River writes (for example an at timestamp in another format, an attempt stored as a string, or an error or trace that isn't a string) are now decoded on a best effort basis when reading jobs from the database. Timestamps outside RFC 3339 are left zero; stored values are unchanged. Previously a single such element made its job unreadable, and if that happened while fetching jobs, every job locked in the same fetch was left running indefinitely. [PR #1380](riverqueue/river#1380).
  • A fetched job whose row can't be decoded (for example a SQLite job whose tags were changed to something other than an array of strings) no longer leaves every job locked in the same fetch stuck running. The other jobs are worked normally, while the undecodable job's attempt fails with an error describing the decode failure, and it's retried or discarded like any other failed job. Its original values are preserved, with non-array errors values wrapped to append the failure or rescue error. Neither the rescuer nor the SQLite scheduler fails on such a job, so its retry doesn't stop other jobs from being rescued or scheduled. [PR #1380](riverqueue/river#1380).
  • Fixed SQLite notification listeners delivering notifications from before a subscription or from an unsubscribe gap. Notification reads now fetch subscribed topics in bounded batches, and cleanup deletes expired notifications in batches of 10,000 rows (reduced to 1,000 after repeated timeouts), with pauses between batches to reduce write lock contention. [PR #1381](riverqueue/river#1381).
  • Fixed the job completer panicking when a job it was finalizing had its state changed concurrently, like being moved to pending out of band, or being rescued while the completer's update waited on the row lock (in which case PostgreSQL returns the job's pre-update running row). Such jobs are now skipped without emitting a completion event. [PR #1383](riverqueue/river#1383).
  • Fixed JobList pagination skipping or repeating jobs when ordering by JobListOrderByTime with multiple states. Cursors now use the same time field as the list's ordering (the one for the first listed state) rather than the one for each job's own state. Jobs where that field is null, like finalized_at for unfinalized jobs, are paginated correctly and consistently sort last in ascending order and first in descending order on all drivers. Ordering by JobListOrderByTime with an empty States() filter now uses scheduled_at instead of returning an error. [PR #1384](riverqueue/river#1384).
  • A SQLite job whose args, attempted_by, errors, metadata, or tags were changed to text that isn't valid JSON no longer makes every fetch from its queue fail with a "malformed JSON" error. The job's attempt fails like that of any other job that can't be decoded, and completing, rescuing, or scheduling it no longer fails either. Invalid values are left in place, except that an invalid errors value is kept as a string in a new array so that attempt errors can still be appended. [PR #1386](riverqueue/river#1386).
  • Fixed UniqueOpts.ByArgs skipping distinct jobs or failing inserts when JSON keys contain path syntax (like user.id), are empty, or come from unnamed tags like json:",omitempty". Unaffected unique keys remain unchanged; affected jobs may be inserted again after upgrading or by old and new clients during a rolling upgrade. [PR #1387](riverqueue/river#1387).
  • Fixed JobListCursor.UnmarshalText rejecting valid cursors whose URL-safe base64 encoding contains - or _, so cursors produced by MarshalText always round-trip. [PR #1388](riverqueue/river#1388).
  • Fixed SQLite drivers deleting jobs in a finalized state whose retention period was set to -1 (keep forever), like Config.DiscardedJobRetentionPeriod: -1, whenever another state's retention period was finite. [PR #1389](riverqueue/river#1389).
  • Fixed SQLite reusing the ID of a deleted job when that job held the largest ID, which could cause an ID observed earlier to refer to an unrelated job later. [PR #1390](riverqueue/river#1390).
  • Fixed the Job appears to be stuck log line reporting the client-level JobTimeout instead of the worker-level timeout when a worker overrides Timeout. [PR #1394](riverqueue/river#1394).

... (truncated)

Changelog

Sourced from github.com/riverqueue/river/riverdriver/riverpgxv5's changelog.

[0.49.0] - 2026-10-05

⚠️ If using River Pro, make sure to upgrade it to at least River Pro v0.32.0 to get a compatible package.

Changed

  • Internal transaction helpers now reuse existing transactions instead of creating unnecessary savepoints. Callers of transactional APIs must roll back their transaction on error; applications that need partial rollback can create an explicit savepoint around the River call. Set RIVER_USE_LEGACY_SUBTRANSACTIONS=1 (or true) before starting the application to restore savepoints in these helpers, including those used by River Pro. This is a temporary compatibility fallback planned for removal in a future release. [PR #1420](riverqueue/river#1420).

Fixed

  • Fixed rivertest.Worker to honor a configured Config.JobStuckThreshold for stuck job detection. Previously, it always used an internal 5 second threshold, so the Job appears to be stuck log line was emitted at a different time than it would be under a real client. [PR #1418](riverqueue/river#1418).
  • Fixed SQLite job cleanup stalling when excluded queues fill the oldest batch, and added support for included queue filters so per-queue retention works on SQLite. [PR #1417](riverqueue/river#1417).
  • Fixed a unique insert skipped as a duplicate of a job of a different kind (possible with UniqueOpts.ExcludeKind) changing the existing job's kind to its own. [PR #1421](riverqueue/river#1421).

[0.48.0] - 2026-09-30

⚠️ This release contains a new database migration, version 8, but it only affects SQLite:

  • If you're on Postgres, you can ignore it with no adverse effect.
  • If you're on SQLite, it rebuilds river_job to add an AUTOINCREMENT keyword to the primary key, preventing a possible edge case where generated job IDs could be reused after deletion. It's not necessary to run the migration for River to work, but it's a good idea to get it in when convenient. [PR #1390](riverqueue/river#1390).

⚠️ If using River Pro, make sure to upgrade it to at least River Pro v0.31.0 to get a compatible package.

Added

  • Added support for YugabyteDB. When LISTEN/NOTIFY is unavailable or disabled, clients automatically poll for running job cancellations and queue pause, resume, and metadata changes, and skip unsupported notification broadcasts. This works with the default PollOnly: false. Native notifications require YugabyteDB 2025.2.3 or later with ysql_yb_enable_listen_notify=true on both Masters and TServers. [PR #1347](riverqueue/river#134...

    Description has been truncated

@dependabot
deps: bump the go-minor-patch group across 1 directory with 8 updates
4c36f10 
Bumps the go-minor-patch group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.33.5` | `1.33.7` |
| [github.com/aws/aws-sdk-go-v2/service/sesv2](https://github.com/aws/aws-sdk-go-v2) | `1.73.0` | `1.78.0` |
| [github.com/aws/aws-sdk-go-v2/service/sts](https://github.com/aws/aws-sdk-go-v2) | `1.51.0` | `1.51.2` |
| [github.com/aws/smithy-go](https://github.com/aws/smithy-go) | `1.28.1` | `1.28.4` |
| [github.com/gowebpki/jcs](https://github.com/gowebpki/jcs) | `1.0.1` | `1.0.2` |
| [github.com/riverqueue/river](https://github.com/riverqueue/river) | `0.47.0` | `0.49.0` |
| [github.com/riverqueue/river/riverdriver/riverpgxv5](https://github.com/riverqueue/river) | `0.47.0` | `0.49.0` |
| [github.com/riverqueue/river/rivertype](https://github.com/riverqueue/river) | `0.47.0` | `0.49.0` |



Updates `github.com/aws/aws-sdk-go-v2/config` from 1.33.5 to 1.33.7
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.33.5...config/v1.33.7)

Updates `github.com/aws/aws-sdk-go-v2/service/sesv2` from 1.73.0 to 1.78.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.73.0...service/s3/v1.78.0)

Updates `github.com/aws/aws-sdk-go-v2/service/sts` from 1.51.0 to 1.51.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.51.0...service/s3/v1.51.2)

Updates `github.com/aws/smithy-go` from 1.28.1 to 1.28.4
- [Release notes](https://github.com/aws/smithy-go/releases)
- [Changelog](https://github.com/aws/smithy-go/blob/main/CHANGELOG.md)
- [Commits](aws/smithy-go@v1.28.1...v1.28.4)

Updates `github.com/gowebpki/jcs` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/gowebpki/jcs/releases)
- [Commits](gowebpki/jcs@v1.0.1...v1.0.2)

Updates `github.com/riverqueue/river` from 0.47.0 to 0.49.0
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.47.0...v0.49.0)

Updates `github.com/riverqueue/river/riverdriver/riverpgxv5` from 0.47.0 to 0.49.0
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.47.0...v0.49.0)

Updates `github.com/riverqueue/river/rivertype` from 0.47.0 to 0.49.0
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.47.0...v0.49.0)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.33.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/aws/aws-sdk-go-v2/service/sesv2
  dependency-version: 1.78.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/aws/aws-sdk-go-v2/service/sts
  dependency-version: 1.51.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/aws/smithy-go
  dependency-version: 1.28.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/gowebpki/jcs
  dependency-version: 1.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/riverqueue/river
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/riverqueue/river/riverdriver/riverpgxv5
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/riverqueue/river/rivertype
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from jiashuoz as a code owner October 10, 2026 10:47
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jiashuoz jiashuoz Awaiting requested review from jiashuoz jiashuoz is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants